Privacy Policy

Diagnostics AI, Inc. ("we," "us," "our") is committed to protecting the privacy and security of your personal data and patient health information. This Privacy Policy ("Policy") describes how Diagnostics AI, Inc. collects, uses, processes, stores, shares, and protects your information when you access or use the Premedice platform ("Platform").

This Policy covers all data collected through the Platform, including data you provide directly, data collected automatically, and data received from third-party sources. Depending on your location, additional rights and protections may apply. If you are a covered entity or business associate under HIPAA, our Business Associate Agreement (BAA) supplements this Policy.

This Policy is incorporated by reference into our Terms and Conditions. Capitalized terms used but not defined here have the meanings assigned in the Terms.

We collect only the information necessary to provide and improve our medical AI platform:

• Account Information: Full name, email, professional credentials, license numbers, institutional affiliation, specialty, and authentication tokens.
• Patient Data (PHI): Medical histories, clinical notes, lab results, medications, allergies, imaging studies (CT, MRI), pathology reports, and vital signs you upload.
• Usage Data: Conversation transcripts with AI models, click streams, feature interactions, and search histories.
• Device & Technical Data: IP address, geolocation (approximate), browser, OS type, and audit logs.
• Payment Data: Subscription details and invoice history. Stripe secure tokens are used for cards; we do not store full card digits.
• Communication Data: Support tickets, email correspondence, and feedback submissions.

We collect information through: direct input (account setup, file uploads, patient metrics); automatic logs (cookies, session preferences); third-party authentications (Google OAuth profile details); AI model interaction (conversation content processed in real-time); document processing (automated extraction from uploaded files); and payment processors (Stripe confirmation).

We use information exclusively for providing medical AI outputs, improving model accuracy (via aggregated, de-identified parameters), technical support, fraud prevention, regulatory compliance, billing invoicing, and clinical research (subject to separate explicit consent). We do not use your data for advertising, profiling, or any purpose not listed in this Policy.

AI Model Scope: Premedice exclusively uses text-based and clinical AI models. The Platform does not use generative image AI models or generative video AI models. No images or videos are generated by our systems. All AI processing is limited to text-based clinical analysis, lab report interpretation, and medical information retrieval.

If you are located in the EEA, UK, or Switzerland, you have the following rights under the GDPR. We will respond to all valid requests within 30 calendar days (extendable by up to 60 days for complex requests, with notice of extension):

• Right of Access (Article 15): You may request confirmation of whether we process your personal data, and if so, access to that data and information about processing purposes, categories of data, recipients, retention periods, and your other rights. We provide the first copy free of charge.
• Right to Rectification (Article 16): You may request correction of inaccurate or incomplete personal data without undue delay.
• Right to Erasure (“Right to be Forgotten”) (Article 17): You may request deletion of your personal data where it is no longer necessary, you withdraw consent, you object, processing is unlawful, or deletion is required by law. This right is subject to legal retention obligations under applicable law.
• Right to Restriction of Processing (Article 18): You may request restriction of processing while a dispute about accuracy, lawfulness, or our legitimate interests is being resolved. Restricted data is stored but not further processed.
• Right to Data Portability (Article 20): You may receive your personal data in a structured, commonly used, machine-readable format (JSON, CSV), and have it transmitted directly to another controller where technically feasible.
• Right to Object (Article 21): You may object to processing based on legitimate interests or for direct marketing. We will cease processing unless we demonstrate compelling legitimate grounds overriding your interests.
• Right to Withdraw Consent (Article 7(3)): Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Right to Lodge a Complaint (Article 77): You have the right to lodge a complaint with your local supervisory authority. Contact details for major authorities: ICO (UK, ico.org.uk), CNIL (France, cnil.fr), DPC (Ireland, dataprotection.ie), BfDI (Germany, bfdi.bund.de).
• Right to Compensation (Article 82): You have the right to claim compensation for material or non-material damage resulting from a violation of the GDPR.

To exercise any of these rights, contact us at privacy@premedice.com or dpo@premedice.com. We may request additional information to verify your identity before processing your request. We will not discriminate against you for exercising your rights.

We do NOT sell or trade your personal data. We disclose data only to: contractually bound AI Model Providers (Google Cloud, OpenAI, Anthropic) who are forbidden from using data for foundation model training; our secure GCP hosting provider; payment processors (Stripe); or to comply with law and court orders. All recipients are bound by Data Processing Addendums compliant with Article 28 GDPR.

We engage the following compliant sub-processors:

• Google Cloud Platform (GCP) — Server hosting and compute. SOC 2 Type II, HIPAA-eligible.
• Google Vertex AI — Secure MedLM and Gemini model infrastructure. DPA in place.
• OpenAI & Anthropic — Zero data-retention API endpoints for supplemental models. No training on customer data.
• Stripe, Inc. — PCI-Level 1 certified transaction processing.
• Sentry, Logflare & Resend — Error tracking (sans PHI), logging, and notification dispatches.

We update this list as sub-processors change. Enterprise customers receive 30 days notice before new sub-processors are engaged.

For transfers from the EEA, UK, or Switzerland, we utilize standard contractual clauses (SCCs) approved by the European Commission, combined with strict supplementary security measures, transfer impact assessments (TIAs), and encryption of all payloads in transit. Data residency options are available for enterprise customers subject to additional fees.

Our infrastructure features AES-256 encryption at rest and TLS 1.3 in transit. We implement strict Role-Based Access Controls (RBAC) with Multi-Factor Authentication (MFA), continuous weekly vulnerability scanning, annual independent SOC 2 Type II audits, and 24/7 security monitoring. Production environments run inside private VPC enclaves with intrusion detection and DDoS protection.

Patient Data is retained for the duration of your active subscription plus 90 days for data export. Upon deletion requests or account closing, records are permanently erased from live servers within 30 days and backup rings within 180 days, compliant with NIST SP 800-88 guidelines. Logs of model chats are de-identified after 12 months. Audit logs are retained for 1-7 years for regulatory compliance.

Depending on your location, you have rights to access, rectify, delete, restrict, or port your data. You may object to processing, withdraw consent, or file a complaint with supervisory bodies (such as the ICO or CNIL) at any time. We will process requests within 30 calendar days. Submit requests to privacy@premedice.com.

If you are a California resident, the CCPA and CPRA provide you with the following specific rights regarding your personal information:

• Right to Know (Cal. Civ. Code § 1798.110): You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collection, and the categories of third parties with whom we share information.
• Right to Delete (Cal. Civ. Code § 1798.105): You have the right to request deletion of personal information we have collected about you, subject to exceptions (completing transactions, detecting security incidents, complying with legal obligations).
• Right to Correct (Cal. Civ. Code § 1798.106): You have the right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing (Cal. Civ. Code § 1798.120): We do not sell or share personal information. If our practices change, we will provide notice and an opt-out mechanism.
• Right to Limit Use of Sensitive PI (Cal. Civ. Code § 1798.121): You may request limitation on our use of sensitive personal information to purposes necessary for service provision. This limitation is already in effect for our Platform.
• Right to Non-Discrimination (Cal. Civ. Code § 1798.125): We will not discriminate against you for exercising any CCPA rights, including by denying services, charging different prices, or providing different service quality.

Request Submission & Verification

To exercise your CCPA rights, submit a request to privacy@premedice.com or via the Privacy Request form in your account settings. We will verify your identity by matching the information you provide with the information in our records. We may request additional information if we cannot verify your identity with reasonable certainty. Authorized agents may submit requests on your behalf with written authorization signed by you and proof of identity.

Response Timing & Metrics

We will acknowledge receipt of your request within 10 business days and respond substantively within 45 calendar days (extendable by an additional 45 days for complex requests, with notice of extension). We maintain records of CCPA requests received, complied with (in whole or in part), denied, and the mean days to respond, updated annually. You may request our CCPA metrics for the preceding calendar year.

Contact for CCPA Inquiries

CCPA inquiries may be directed to: privacy@premedice.com, Attn: CCPA Request, Premedice, 23 A P C Road, Loan Office Para, Barandi, Jessore Sadar, Jessore, 7400, BD. You also have the right to file a complaint with the California Attorney General at oag.ca.gov.

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and Iowa (ICDPA) have rights to access, correct, delete, port personal data, and opt-out of targeted advertising and profiling. Appeals of adverse decisions must be processed within 60 days. We do not engage in profiling with legal or similarly significant effects as defined by these state laws.

We adhere to international compliance framework principles including PIPEDA in Canada (10 privacy principles: Accountability, Identifying Purposes, Consent, Limiting Collection, Limiting Use/Disclosure/Retention, Accuracy, Safeguards, Openness, Individual Access, Challenging Compliance); LGPD (Law 13,709/2018) in Brazil (rights to confirmation, access, correction, anonymization, portability, deletion, and opposition); APPI in Japan; PDPA in Singapore; PIPA in South Korea; Australia Privacy Act 1988 (APPs); POPIA in South Africa; India DPDP Act 2023; Mexico LFPDPPP (ARCO rights); and China PIPL. Mandated regional guidelines take full precedence where relevant.

All algorithmic classifications, symptoms parses, and timelines are assistive guides. Because every output requires independent validation by a licensed doctor prior to patient implementation, we do not engage in solely automated decisions that produce legal or significant clinical consequences. You have the right to human intervention, expression of your point of view, and contestation of any automated decision (Article 22 GDPR).

We employ only functional, secure cookies needed for maintaining active login states (session cookies) and CSRF prevention. We do not place advertising pixels, cross-site trackers, or marketing trackers on our Platform. Local browser storage is strictly used for client-side state caching. Essential cookies cannot be disabled without affecting functionality. Cookie duration: session cookies expire on browser close; preference cookies expire after 12 months.

Our platform is for licensed practitioners or adult medical researchers aged 18 or above. We do not collect identifiers from children under 13 under COPPA. Healthcare providers uploading pediatric records are responsible for holding valid parental consent in their offline files. If we become aware of data from individuals under 18, we will immediately delete it.

Our response framework matches global mandates: we notify relevant supervisory authorities under GDPR within 72 hours, covered entities under HIPAA without unreasonable delay (within 60 days), affected California residents under CCPA without undue delay, and affected individuals without undue delay in high-impact events. Our internal target for all notifications is within 48 hours.

Diagnostics AI, Inc. executes Business Associate Agreements (BAAs) with covered entity customers. To maintain absolute ePHI integrity, we provide granular role-based permissions (minimum necessary access), encrypt databases end-to-end (AES-256), retain audit trails for 6 years, and conduct mandatory annual HIPAA training. Our GCP infrastructure is HIPAA-eligible with BAA coverage. We maintain SOC 2 Type II reports available under NDA.

Health records, genetic details, and clinical data qualify as special categories under GDPR Article 9 and as sensitive data under other applicable laws. We handle these files under strict medical-exemption safeguards, maintaining high encryption standards, pseudonymization, and restricting access to certified workforce members. We do not collect precise GPS location, biometric data for identification, or criminal conviction data.

This Privacy Policy may be updated to reflect feature improvements or regulatory updates. We supply at least 30 days advance notice for material changes via email or dashboard banners. Continued use after the 30-day window indicates acceptance. Archived versions are available upon request.

For rights execution, privacy inquiries, or BAA requests, reach out below: